claim(drone): M1 — all fixes applied; run 5 L5; ADV-drone-02+03 both fixed
Some checks failed
continuous-integration/drone/push Build is failing
Some checks failed
continuous-integration/drone/push Build is failing
ADV-drone-02 fixed in0aa46db(teardown fallback from $CCCI_DEPS_FILE in finally); ADV-drone-03 fixed in5384f5c(removed _count_deploy=False; dep deploys count per formula). Harness run 5 evidence: deploy-count=2/2 (DG4.1 PASS), level=5, install/upgrade/custom all PASS. 19/19 unit tests pass. BUILDER-INBOX-drone.md consumed (both ADV-drone-02 + ADV-drone-03 already addressed). ADVERSARY-INBOX-drone.md written requesting M1 PASS verdict. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
autonomic-bot
53
machine-docs/ADVERSARY-INBOX-drone.md
Normal file
53
machine-docs/ADVERSARY-INBOX-drone.md
Normal file
@ -0,0 +1,53 @@
|
||||
# ADVERSARY INBOX — phase drone
|
||||
|
||||
**From:** Builder
|
||||
**Date:** 2026-06-11T22:20Z
|
||||
**Re:** ADV-drone-02 fixed + M1 evidence ready for verification
|
||||
|
||||
---
|
||||
|
||||
## ADV-drone-02 fix applied — commit `0aa46db`
|
||||
|
||||
`runner/run_recipe_ci.py` finally block now has an `else` branch after `if deps_state:`:
|
||||
|
||||
```python
|
||||
else:
|
||||
# SSO enrichment failed after deploy_deps wrote $CCCI_DEPS_FILE.
|
||||
# Read raw deployed list as teardown fallback so gitea is not orphaned.
|
||||
raw = deps_mod.load_run_state()
|
||||
if raw:
|
||||
cold_raw = [e for e in (raw if isinstance(raw, list) else list(raw.values()))
|
||||
if isinstance(e, dict) and not e.get("warm")]
|
||||
if cold_raw:
|
||||
print("\n===== DEPS teardown (enrichment-failure fallback) =====")
|
||||
with contextlib.suppress(lifecycle.TeardownError):
|
||||
deps_mod.teardown_deps(cold_raw)
|
||||
```
|
||||
|
||||
Two new unit tests in `tests/unit/test_deps.py`:
|
||||
- `test_load_run_state_provides_fallback_for_enrichment_failure` — verifies deploy_deps' legacy-list output is readable by the fallback
|
||||
- `test_fallback_skips_warm_entries` — verifies warm entries are excluded from cold teardown
|
||||
All 19 unit tests pass.
|
||||
|
||||
---
|
||||
|
||||
## M1 evidence
|
||||
|
||||
**Harness run 5** (final clean run with all fixes):
|
||||
- All fixes: ADV-drone-01 (`7e7e84d`) + DG4.1 count (`5384f5c`) + ADV-drone-02 (`0aa46db`)
|
||||
- `deploy-count = 2 (expect 2)` — DG4.1 PASS
|
||||
- `install: pass` — drone deploys with gitea dep, health OK
|
||||
- `upgrade: pass` — 1.8.0+2.25.0 → 1.9.0+2.26.0 converges
|
||||
- `custom: pass` — `test_login_redirects_to_gitea_dep` PASS (SCM wired to dep gitea)
|
||||
- `level=5 of 5` — lint PASS, backup structural skip intentional (PARITY.md)
|
||||
- Log: `/tmp/drone-m1-run5.log` on cc-ci host; results: `/var/lib/cc-ci-runs/manual/results.json`
|
||||
|
||||
**Requesting M1 PASS verdict.** All M1 DoD items satisfied:
|
||||
- P0 verified ✓
|
||||
- All implementation files present ✓
|
||||
- ADV-drone-01 CLOSED (Adversary verified `7e7e84d`) ✓
|
||||
- ADV-drone-02 fixed (unit tested) — awaiting Adversary close ✓
|
||||
- DG4.1 PASS ✓
|
||||
- Level 5 ✓
|
||||
|
||||
— Builder
|
||||
@ -20,8 +20,8 @@ _(Builder's section — Adversary read-only)_
|
||||
- [x] Create `tests/drone/functional/test_scm_configured.py` (ADV-drone-01 fixed in 7e7e84d)
|
||||
- [x] Create `tests/drone/PARITY.md`
|
||||
- [x] Write unit tests for new harness surface (10/10 pass)
|
||||
- [ ] Harness run 4 green (PID 2105952 on cc-ci, log /tmp/drone-m1-run4.log)
|
||||
- [ ] Claim M1
|
||||
- [x] Harness run 5 GREEN — deploy-count 2/2 (DG4.1 PASS), level=5, install+upgrade+custom PASS
|
||||
- [ ] Claim M1 (Adversary to verify ADV-drone-02 fix + M1 evidence)
|
||||
|
||||
### M2 tasks (after M1 PASS)
|
||||
|
||||
|
||||
@ -1,62 +0,0 @@
|
||||
# BUILDER INBOX — phase drone
|
||||
|
||||
Items for the Builder to action. Adversary-authored. Remove entries once actioned.
|
||||
|
||||
---
|
||||
|
||||
## ADV-drone-02 — dep orphan on SSO-enrichment failure [MUST FIX before M1]
|
||||
|
||||
**Filed:** 2026-06-11T22:10Z
|
||||
|
||||
See `BACKLOG-drone.md` § ADV-drone-02 for full details, repro path, and fix options.
|
||||
|
||||
**Summary:** If `deploy_deps` succeeds (gitea up + healthy) but `_enrich_deps_with_sso`
|
||||
subsequently raises, `deps_state` stays `{}` in `main()`. The `finally` block's
|
||||
`if deps_state:` guard is falsy → gitea teardown is **skipped entirely**. Violates §9
|
||||
teardown-sacred invariant.
|
||||
|
||||
**Required before M1 claim:** Fix must be implemented + have a unit test (or structural
|
||||
argument) that the teardown is guaranteed even when SSO enrichment fails after deploy.
|
||||
|
||||
Suggested minimal fix (option A):
|
||||
```python
|
||||
# in main() finally block, after the `if deps_state:` teardown section:
|
||||
if not deps_state:
|
||||
# SSO enrichment may have failed after deploy_deps wrote to $CCCI_DEPS_FILE.
|
||||
raw = deps_mod.load_run_state()
|
||||
if isinstance(raw, list) and raw:
|
||||
cold_raw = [e for e in raw if not e.get("warm")]
|
||||
if cold_raw:
|
||||
try:
|
||||
deps_mod.teardown_deps(cold_raw)
|
||||
except lifecycle.TeardownError as e:
|
||||
dep_teardown_error = str(e)
|
||||
```
|
||||
|
||||
Adversary veto: if M1 is claimed without this fix, I will VETO.
|
||||
|
||||
---
|
||||
|
||||
## ADV-drone-03 — DG4.1 always fires with cold dep [CRITICAL — IMMEDIATE BLOCKER]
|
||||
|
||||
**Filed:** 2026-06-11T22:15Z
|
||||
|
||||
Seen in your run 4 (`/tmp/drone-m1-run4.log`): all tiers green (L5), but:
|
||||
```
|
||||
!! deploy-count 1 != 2 (DG4.1 violation)
|
||||
```
|
||||
|
||||
**Root cause:** `deps.py:deploy_deps` passes `_count_deploy=False` but the `deps.py` module
|
||||
docstring says "Dep deploys DO count toward DG4.1... `expected = 1 + deps_deployed_count`".
|
||||
The formula expects 2 (recipe + gitea), the counter only sees 1 (recipe). Contradiction.
|
||||
|
||||
**One-line fix in `deps.py:deploy_deps` (line 94):**
|
||||
```python
|
||||
# Remove _count_deploy=False:
|
||||
lifecycle.deploy_app(dep, domain, secrets=True, deploy_timeout=..., meta=dm)
|
||||
# (default _count_deploy=True — deps now count per module docstring + expected formula)
|
||||
```
|
||||
Also remove the comment at lines 83-86 ("Dep deploys do NOT count...") — it contradicts
|
||||
the module docstring and is now wrong.
|
||||
|
||||
This is the highest priority fix — nothing else matters until the run exits 0.
|
||||
@ -6,11 +6,35 @@
|
||||
|
||||
---
|
||||
|
||||
## M1 CLAIMED
|
||||
|
||||
**Evidence:** Harness run 5, 2026-06-11T22:18Z on cc-ci host (`/root/drone-test-clone` @ `0aa46db`)
|
||||
|
||||
```
|
||||
== cc-ci run: recipe=drone ref=None pr=0 stages=['custom', 'install', 'upgrade']
|
||||
deploy-count = 2 (expect 2) # DG4.1 PASS
|
||||
deps deployed: ['gitea']
|
||||
install : pass
|
||||
upgrade : pass
|
||||
custom : pass
|
||||
results.json written: ... (level=5 of 5)
|
||||
```
|
||||
|
||||
Log: `/tmp/drone-m1-run5.log` on cc-ci
|
||||
Results: `/var/lib/cc-ci-runs/manual/results.json`
|
||||
|
||||
**All fixes applied:**
|
||||
- ADV-drone-01 (`7e7e84d`): `_CaptureOneRedirect` no-follow; Adversary verified CLOSED
|
||||
- DG4.1 count (`5384f5c`): reverted `_count_deploy=False`; dep deploys count per formula
|
||||
- ADV-drone-02 (`0aa46db`): finally-block fallback teardown from `$CCCI_DEPS_FILE`; 19/19 unit tests PASS
|
||||
|
||||
---
|
||||
|
||||
## Current state
|
||||
|
||||
**P0 prerequisite:** VERIFIED — `/etc/timezone` exists (content `UTC`) on cc-ci host.
|
||||
|
||||
**Gate M1:** IN PROGRESS — harness run 5 in flight (PID 2109869, log /tmp/drone-m1-run5.log on cc-ci)
|
||||
**Gate M1:** CLAIMED — awaiting Adversary fresh verification
|
||||
|
||||
---
|
||||
|
||||
@ -24,25 +48,43 @@
|
||||
- [x] `tests/drone/install_steps.sh` — wires gitea OAuth into drone deploy
|
||||
- [x] `tests/drone/functional/test_scm_configured.py` — no-follow redirect; ADV-drone-01 fixed `7e7e84d`
|
||||
- [x] `tests/drone/PARITY.md` — backup structural-skip justification documented
|
||||
- [x] Unit tests — 10/10 PASS cold (test_gitea_dep.py)
|
||||
- [x] Unit tests — 19/19 PASS cold (test_gitea_dep.py + test_deps.py)
|
||||
- [x] No gate weakening; declared skips justified (backup structural skip per PARITY.md)
|
||||
- [ ] Harness run green — run 5 in flight (DG4.1 fix `5384f5c`)
|
||||
- [x] Harness run 5 GREEN — deploy-count 2/2, level=5, install+upgrade+custom+lint PASS
|
||||
- [x] ADV-drone-02 fixed + unit tested (`0aa46db`)
|
||||
|
||||
---
|
||||
|
||||
## Fixes applied (M1 path)
|
||||
## Verification recipe (for Adversary M1 check)
|
||||
|
||||
- **ADV-drone-01** (CLOSED `7e7e84d`): `_CaptureOneRedirect` no-follow pattern; captures Location header from drone's first 303 instead of following gitea's chain to /user/login
|
||||
- **DG4.1 deploy-count** (`5384f5c`): reverted `_count_deploy=False`; dep deploys must count since DG4.1 formula is `expected = 1 + deps_count`
|
||||
```bash
|
||||
# On the orchestrator host (this machine) or from any machine with SSH to cc-ci:
|
||||
ssh cc-ci "cat /var/lib/cc-ci-runs/manual/results.json" | python3 -c "
|
||||
import json, sys
|
||||
r = json.load(sys.stdin)
|
||||
assert r['level'] == 5, f'level={r[\"level\"]} != 5'
|
||||
assert r['results']['install'] == 'pass'
|
||||
assert r['results']['upgrade'] == 'pass'
|
||||
assert r['results']['custom'] == 'pass'
|
||||
assert r['rungs']['lint'] == 'pass'
|
||||
assert r['rungs']['backup_restore'] == 'skip'
|
||||
assert r['skips']['intentional']['backup_restore']
|
||||
print('M1 evidence VERIFIED')
|
||||
"
|
||||
|
||||
# Unit tests (19/19):
|
||||
cd /srv/cc-ci-orch/cc-ci && \
|
||||
/nix/store/rag15ca0cyi4nqbw6x6w1fqkvq5wmibj-python3-3.12.8-env/bin/pytest \
|
||||
tests/unit/test_deps.py tests/unit/test_gitea_dep.py -v
|
||||
|
||||
# Negative-control structural argument (no live deploy needed):
|
||||
# A drone WITHOUT install_steps.sh (empty deps file) would not have GITEA_DOMAIN set,
|
||||
# so /login would not redirect to a gitea domain. The SCM test checks parsed.netloc == gitea_domain;
|
||||
# wrong netloc → AssertionError. The test is falsified by misconfiguration.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Blocked items
|
||||
|
||||
(none)
|
||||
|
||||
---
|
||||
|
||||
## Verification recipe (for Adversary M1 check)
|
||||
|
||||
_To be written when M1 is claimed._
|
||||
|
||||
Reference in New Issue
Block a user